All CosmicBytez Labs articles tagged #Container Security, across news, security advisories, how-to guides, and projects.
A CVSS 9.9 path traversal flaw in LXD's template processing lets attackers with container permissions overwrite arbitrary host files.
docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.
Critical Incus flaw lets a specially crafted container image read or write arbitrary host files, leading to remote code execution. Fixed in v7.2.0.
Critical Incus flaw: if exec-output is a symlink, command output files are written to arbitrary host paths. Fixed in v7.2.0.
Critical Incus flaw allows privilege escalation via unrestricted config overrides during cross-cluster instance migration. Patch to v7.3.0.
Critical TOCTOU flaw in Incus lets restricted project users escalate privileges by copying instances across projects. Fixed in v7.3.0.
A CVSS 9.8 OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas allows unauthenticated remote code execution via a crafted POST request to…
A Linux kernel vulnerability in the cgroups v1 release_agent feature allows local attackers to escalate privileges and escape containers. Added to CISA KEV…
DockSec, an OWASP incubator project, combines multiple container security scanners with AI-generated plain-English remediation guidance and exact Dockerfile.
A high-severity security bypass in Argo Workflows (CVSS 8.1) allows users with Workflow creation permissions to escape templateReferencing: Strict mode,...
A critical CVSS 9.1 flaw in Canonical LXD versions 4.12 through 6.7 omits raw.apparmor and raw.qemu.conf from the VM low-level option denylist, allowing...
A critical CVSS 9.1 vulnerability in Canonical LXD before 6.8 allows authenticated attackers to bypass project restrictions during backup import. The...
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
Chainguard's first-ever State of Trusted Open Source report reveals critical insights into open source consumption patterns across container images,...
Step-by-step guide to deploying Falco as a Kubernetes runtime security engine. Covers Helm installation, custom rule authoring, Falcosidekick alerting...
Researchers uncover VoidLink, an 88,000-line Zig-based malware framework built with AI assistance that targets AWS, Azure, GCP, and Kubernetes environments.